Title 49—Transportation--Volume 1
PART 236—RULES, STANDARDS, AND INSTRUCTIONS GOVERNING THE INSTALLATION, INSPECTION, MAINTENANCE, AND REPAIR OF SIGNAL AND TRAIN CONTROL SYSTEMS, DEVICES, AND APPLIANCES
§ 236.1007   Additional requirements for high-speed service.
(a) A PTC railroad that conducts a passenger operation at or greater than 60 miles per hour or a freight operation at or greater than 50 miles per hour shall have installed a PTC system including or working in concert with technology that includes all of the safety-critical functional attributes of a block signal system meeting the requirements of this part, including appropriate fouling circuits and broken rail detection (or equivalent safeguards).
(b) In addition to the requirements of paragraph (a) of this section, a host railroad that conducts a freight or passenger operation at more than 90 miles per hour shall:
(1) Have an approved PTCSP establishing that the system was designed and will be operated to meet the fail-safe operation criteria described in Appendix C to this part; and
(2) Prevent unauthorized or unintended entry onto the main line from any track not equipped with a PTC system compliant with this subpart by placement of split-point derails or equivalent means integrated into the PTC system; and
(3) Comply with § 236.1029(c).
(c) In addition to the requirements of paragraphs (a) and (b) of this section, a host railroad that conducts a freight or passenger operation at more than 125 miles per hour shall have an approved PTCSP accompanied by a document (“HSR-125”) establishing that the system:
(1) Will be operated at a level of safety comparable to that achieved over the 5 year period prior to the submission of the PTCSP by other train control systems that perform PTC functions required by this subpart, and which have been utilized on high-speed rail systems with similar technical and operational characteristics in the United States or in foreign service, provided that the use of foreign service data must be approved by the Associate Administrator before submittal of the PTCSP; and
(2) Has been designed to detect incursions into the right-of-way, including incidents involving motor vehicles diverting from adjacent roads and bridges, where conditions warrant.
(d) A railroad providing existing high-speed passenger service may request in its PTCSP that the Associate Administrator excuse compliance with one or more requirements of this section upon a showing that the subject service has been conducted with a high level of safety.
§ 236.1009   Procedural requirements.
(a) PTC Implementation Plan (PTCIP). (1) By April 16, 2010, each host railroad that is required to implement and operate a PTC system in accordance with § 236.1005(b) shall develop and submit in accordance with § 236.1011(a) a PTCIP for implementing a PTC system required under § 236.1005. Filing of the PTCIP shall not exempt the required filings of an NPI, PTCSP, PTCDP, or Type Approval.
(2) After April 16, 2010, a host railroad shall file:
(i) A PTCIP if it becomes a host railroad of a main line track segment for which it is required to implement and operate a PTC system in accordance with § 236.1005(b); or
(ii) A request for amendment (“RFA”) of its current and approved PTCIP in accordance with § 236.1021 if it intends to:
(A) Initiate a new category of service (i.e., passenger or freight); or
(B) Add, subtract, or otherwise materially modify one or more lines of railroad for which installation of a PTC system is required.
(3) The host and tenant railroad(s) shall jointly file a PTCIP that addresses shared track:
(i) If the host railroad is required to install and operate a PTC system on a segment of its track; and
(ii) If the tenant railroad that shares the same track segment would have been required to install a PTC system if the host railroad had not otherwise been required to do so.
(4) If railroads required to file a joint PTCIP are unable to jointly file a PTCIP in accordance with paragraphs (a)(1) and (a)(3) of this section, then each railroad shall:
(i) Separately file a PTCIP in accordance with paragraph (a)(1);
(ii) Notify the Associate Administrator that the subject railroads were unable to agree on a PTCIP to be jointly filed;
(iii) Provide the Associate Administrator with a comprehensive list of all issues not in agreement between the railroads that would prevent the subject railroads from jointly filing the PTCIP; and
(iv) Confer with the Associate Administrator to develop and submit a PTCIP mutually acceptable to all subject railroads.
(5) Each railroad filing a PTCIP shall report annually, by March 31 of each year, and until its PTC system implementation is complete, its progress towards fulfilling the goals outlined in its PTCIP under this part, including progress towards PTC system installation pursuant to § 236.1005 and onboard PTC apparatus installation and use in PTC-equipped track segments pursuant to § 236.1006, as well as impediments to completion of each of the goals.
(b) Type Approval. Each host railroad, individually or jointly with others such as a tenant railroad or system supplier, shall file prior to or simultaneously with the filing made in accordance with paragraph (a) of this section:
(1) An unmodified Type Approval previously issued by the Associate Administrator in accordance with § 236.1013 or § 236.1031(b) with its associated docket number;
(2) A PTCDP requesting a Type Approval for:
(i) A PTC system that does not have a Type Approval; or
(ii) A PTC system with a previously issued Type Approval that requires one or more variances;
(3) A PTCSP subject to the conditions set forth in paragraph (c) of this section, with or without a Type Approval; or
(4) A document attesting that a Type Approval is not necessary since the host railroad has no territory for which a PTC system is required under this subpart.
(c) Notice of Product Intent (NPI). A railroad may, in lieu of submitting a PTCDP, or referencing an already issued Type Approval, submit an NPI describing the functions of the proposed PTC system. If a railroad elects to file an NPI in lieu of a PTCDP or referencing an existing Type Approval with the PTCIP, and the PTCIP is otherwise acceptable to the Associate Administrator, the Associate Administrator may grant provisional approval of the PTCIP.
(1) A provisional approval of a PTCIP, unless otherwise extended by the Associate Administrator, is valid for a period of 270 days from the date of approval by the Associate Administrator.
(2) The railroad must submit an updated PTCIP with either a complete PTCDP as defined in § 236.1013(a), an updated PTCIP referencing an already approved Type Approval, or a full PTCSP within 270 days after the “Provisional Approval.”
(i) Within 90 days of receipt of an updated PTCIP that was submitted with an NPI, the Associate Administrator will approve or disapprove of the updated PTCIP and notify in writing the affected railroad. If the updated PTCIP is not approved, the notification will include the plan's deficiencies. Within 30 days of receipt of that notification, the railroad or other entity that submitted the plan shall correct all deficiencies and resubmit the plan in accordance with this section and § 236.1011, as applicable.
(ii) If an update to a “Provisionally Approved” PTCIP is not received by the Associate Administrator by the end of the period indicated in this paragraph, the “Provisional Approval” given to the PTCIP is automatically revoked. The revocation is retroactive to the date the original PTCIP and NPI were first submitted to the Associate Administrator.
(d) PTCSP and PTC System Certification. The following apply to each PTCSP and PTC System Certification.
(1) A PTC System Certification for a PTC system may be obtained by submitting an acceptable PTCSP. If the PTC system is the subject of a Type Approval, the safety case elements contained in the PTCDP may be incorporated by reference into the PTCSP, subject to finalization of the human factors analysis contained in the PTCDP.
(2) Each PTCSP requirement under § 236.1015 shall be supported by information and analysis sufficient to establish that the requirements of this subpart have been satisfied.
(3) If the Associate Administrator finds that the PTCSP and supporting documentation support a finding that the system complies with this part, the Associate Administrator may approve the PTCSP. If the Associate Administrator approves the PTCSP, the railroad shall receive PTC System Certification for the subject PTC system and shall implement the PTC system according to the PTCSP.
(4) A required PTC system shall not:
(i) Be used in service until it receives from FRA a PTC System Certification; and
(ii) Receive a PTC System Certification unless FRA receives and approves an applicable:
(A) PTCSP; or
(B) Request for Expedited Certification (REC) as defined by § 236.1031(a).
(e) Plan contents. (1) No PTCIP shall receive approval unless it complies with § 236.1011. No railroad shall receive a Type Approval or PTC System Certification unless the applicable PTCDP or PTCSP, respectively, comply with §§ 236.1013 and 236.1015, respectively.
(2) All materials filed in accordance with this subpart must be in the English language, or have been translated into English and attested as true and correct.
(3) Each filing referenced in this section may include a request for full or partial confidentiality in accordance with § 209.11 of this chapter. If confidentiality is requested as to a portion of any applicable document, then in addition to the filing requirements under § 209.11 of this chapter, the person filing the document shall also file a copy of the original unredacted document, marked to indicate which portions are redacted in the document's confidential version without obscuring the original document's contents.
(f) Supporting documentation and information. (1) Issuance of a Type Approval or PTC System Certification is contingent upon FRA's confidence in the implementation and operation of the subject PTC system. This confidence may be based on FRA-monitored field testing or an independent assessment performed in accordance with § 236.1035 or § 236.1017, respectively.
(2) Upon request by FRA, the railroad requesting a Type Approval or PTC System Certification must engage in field testing or independent assessment performed in accordance with § 236.1035 or § 236.1017, respectively, to support the assertions made in any of the plans submitted under this subpart. These assertions include any of the plans' content requirements under this subpart.
(g) FRA conditions, reconsiderations, and modifications. (1) As necessary to ensure safety, FRA may attach special conditions to approving a PTCIP or issuing a Type Approval or PTC System Certification.
(2) After granting a Type Approval or PTC System Certification, FRA may reconsider the Type Approval or PTC System Certification upon revelation of any of the following factors concerning the contents of the PTCDP or PTCSP:
(i) Potential error or fraud;
(ii) Potentially invalidated assumptions determined as a result of in-service experience or one or more unsafe events calling into question the safety analysis supporting the approval.
(3) During FRA's reconsideration in accordance with this paragraph, the PTC system may remain in use if otherwise consistent with the applicable law and regulations and FRA may impose special conditions for use of the PTC system.
(4) After FRA's reconsideration in accordance with this paragraph, FRA may:
(i) Dismiss its reconsideration and continue to recognize the existing FRA approved Type Approval or PTC System Certification;
(ii) Allow continued operations under such conditions the Associate Administrator deems necessary to ensure safety; or
(iii) Revoke the Type Approval or PTC System Certification and direct the railroad to cease operations where PTC systems are required under this subpart.
(h) FRA access. The Associate Administrator, or that person's designated representatives, shall be afforded reasonable access to monitor, test, and inspect processes, procedures, facilities, documents, records, design and testing materials, artifacts, training materials and programs, and any other information used in the design, development, manufacture, test, implementation, and operation of the system, as well as interview any personnel:
(1) Associated with a PTC system for which a Type Approval or PTC System Certification has been requested or provided; or
(2) To determine whether a railroad has been in compliance with this subpart.
(i) Foreign regulatory entity verification. Information that has been certified under the auspices of a foreign regulatory entity recognized by the Associate Administrator may, at the Associate Administrator's sole discretion, be accepted as independently Verified and Validated and used to support each railroad's development of the PTCSP.
(j) Processing times for PTCDP and PTCSP.
(1) Within 30 days of receipt of a PTCDP or PTCSP, the Associate Administrator will either acknowledge receipt or acknowledge receipt and request more information.
(2) To the extent practicable, considering the scope, complexity, and novelty of the product or change:
(i) FRA will approve, approve with conditions, or deny the PTCDP within 60 days of the date on which the PTCDP was filed;
(ii) FRA will approve, approve with conditions, or deny the PTCSP within 180 days of the date on which the PTCSP was filed;
(iii) If FRA has not approved, approved with conditions, or denied the PTCDP or PTCSP within the 60-day or 180-day window, as applicable, FRA will provide the submitting party with a statement of reasons as to why the submission has not yet been acted upon and a projected deadline by which an approval or denial will be issued and any further consultations or inquiries will be resolved.
§ 236.1011   PTC Implementation Plan content requirements.
(a) Contents. A PTCIP filed pursuant to this subpart shall, at a minimum, describe:
(1) The functional requirements that the proposed system must meet;
(2) How the PTC railroad intends to comply with §§ 236.1009(c) and (d);
(3) How the PTC system will provide for interoperability of the system between the host and all tenant railroads on the track segments required to be equipped with PTC systems under this subpart and:
(i) Include relevant provisions of agreements, executed by all applicable railroads, in place to achieve interoperability;
(ii) List all methods used to obtain interoperability; and
(iii) Identify any railroads with respect to which interoperability agreements have not been achieved as of the time the plan is filed, the practical obstacles that were encountered that prevented resolution, and the further steps planned to overcome those obstacles;
(4) How, to the extent practical, the PTC system will be implemented to address areas of greater risk to the public and railroad employees before areas of lesser risk;
(5) The sequence and schedule in which track segments will be equipped and the basis for those decisions, and shall at a minimum address the following risk factors by track segment:
(i) Segment traffic characteristics such as typical annual passenger and freight train volume and volume of poison- or toxic-by-inhalation (PIH or TIH) shipments (loads, residue);
(ii) Segment operational characteristics such as current method of operation (including presence or absence of a block signal system), number of tracks, and maximum allowable train speeds, including planned modifications; and
(iii) Route attributes bearing on risk, including ruling grades and extreme curvature;
(6) The following information relating to rolling stock:
(i) What rolling stock will be equipped with PTC technology;
(ii) The schedule to equip that rolling stock by the applicable deadline under § 236.1005(b)(7);
(iii) All documents and information required by § 236.1006; and
(iv) Unless the tenant railroad is filing its own PTCIP, the host railroad's PTCIP shall:
(A) Attest that the host railroad has made a formal written request to each tenant railroad requesting identification of each item of rolling stock to be PTC system equipped and the date each will be equipped; and
(B) Include each tenant railroad's response to the host railroad's written request made in accordance with paragraph (a)(6)(iv)(A) of this section;
(7) The number of wayside devices required for each track segment and the installation schedule to complete wayside equipment installation by the applicable deadline under § 236.1005(b)(7);
(8) Identification of each track segment on the railroad as mainline or non-mainline track. If the PTCIP includes an MTEA, as defined by § 236.1019, the PTCIP should identify the tracks included in the MTEA as main line track with a reference to the MTEA;
(9) To the extent the railroad determines that risk-based prioritization required by paragraph (a)(4) of this section is not practical, the basis for this determination; and
(10) The dates the associated PTCDP and PTCSP, as applicable, will be submitted to FRA in accordance with § 236.1009.
(b) Additional Class I railroad PTCIP requirements. Each Class I railroad shall include:
(1) In its PTCIP a strategy for full deployment of its PTC system, describing the criteria that it will apply in identifying additional rail lines on its own network, and rail lines of entities that it controls or engages in joint operations with, for which full or partial deployment of PTC technologies is appropriate, beyond those required to be equipped under this subpart. Such criteria shall include consideration of the policies established by 49 U.S.C. 20156 (railroad safety risk reduction program), and regulations issued thereunder, as well as non-safety business benefits that may accrue.
(2) In the Technology Implementation Plan of its Risk Reduction Program, when first required to be filed in accordance with 49 U.S.C. 20156 and any regulation promulgated thereunder, a specification of rail lines selected for full or partial deployment of PTC under the criteria identified in its PTCIP.
(3) Nothing in this paragraph shall be construed to create an expectation or requirement that additional rail lines beyond those required to be equipped by this subpart must be equipped or that such lines will be equipped during the period of primary implementation ending on the applicable deadline under § 236.1005(b)(7).
(4) As used in this paragraph, “partial implementation” of a PTC system refers to use, pursuant to subpart H of this part, of technology embedded in PTC systems that does not employ all of the functionalities required by this subpart.
(c) FRA review. Within 90 days of receipt of a PTCIP, the Associate Administrator will approve or disapprove of the plan and notify in writing the affected railroad or other entity. If the PTCIP is not approved, the notification will include the plan's deficiencies. Within 30 days of receipt of that notification, the railroad or other entity that submitted the plan shall correct all deficiencies and resubmit the plan in accordance with § 236.1009 and paragraph (a) of this section, as applicable.
(d) Subpart H. A railroad that elects to install a PTC system when not required to do so may elect to proceed under this subpart or under subpart H of this part.
(e) Upon receipt of a PTCIP, NPI, PTCDP, or PTCSP, FRA posts on its public web site notice of receipt and reference to the public docket in which a copy of the filing has been placed. FRA may consider any public comment on each document to the extent practicable within the time allowed by law and without delaying implementation of PTC systems.
(f) The PTCIP shall be maintained to reflect the railroad's most recent PTC deployment plans until all PTC system deployments required under this subpart are complete.
§ 236.1013   PTC Development Plan and Notice of Product Intent content requirements and Type Approval.
(a) For a PTC system to obtain a Type Approval from FRA, the PTCDP shall be filed in accordance with § 236.1009 and shall include:
(1) A complete description of the PTC system, including a list of all PTC system components and their physical relationships in the subsystem or system;
(2) A description of the railroad operation or categories of operations on which the PTC system is designed to be used, including train movement density (passenger, freight), operating speeds (including a thorough explanation of intended compliance with § 236.1007), track characteristics, and railroad operating rules;
(3) An operational concepts document, including a list with complete descriptions of all functions which the PTC system will perform to enhance or preserve safety;
(4) A document describing the manner in which the PTC system architecture satisfies safety requirements;
(5) A preliminary human factors analysis, including a complete description of all human-machine interfaces and the impact of interoperability requirements on the same;
(6) An analysis of the applicability to the PTC system of the requirements of subparts A through G of this part that may no longer apply or are satisfied by the PTC system using an alternative method, and a complete explanation of the manner in which those requirements are otherwise fulfilled;
(7) A prioritized service restoration and mitigation plan and a description of the necessary security measures for the system;
(8) A description of target safety levels (e.g., MTTHE for major subsystems as defined in subpart H of this part), including requirements for system availability and a description of all backup methods of operation and any critical assumptions associated with the target levels;
(9) A complete description of how the PTC system will enforce authorities and signal indications;
(10) A description of the deviation which may be proposed under § 236.1029(c), if applicable; and
(11) A complete description of how the PTC system will appropriately and timely enforce all integrated hazard detectors in accordance with § 236.1005(c)(3), if applicable.
(b) If the Associate Administrator finds that the system described in the PTCDP would satisfy the requirements for PTC systems under this subpart and that the applicant has made a reasonable showing that a system built to the stated requirements would achieve the level of safety mandated for such a system under § 236.1015, the Associate Administrator may grant a numbered Type Approval for the system.
(c) Each Type Approval shall be valid for a period of 5 years, subject to automatic and indefinite extension provided that at least one PTC System Certification using the subject PTC system has been issued within that period and not revoked.
(d) The Associate Administrator may prescribe special conditions, amendments, and restrictions to any Type Approval as necessary for safety.
(e) If submitted, an NPI must contain the following information:
(1) A description of the railroad operation or categories of operations on which the proposed PTC system is designed to be used, including train movement density (passenger, freight), operating speeds (including a thorough explanation of intended compliance with § 236.1007), track characteristics, and railroad operating rules;
(2) An operational concepts document, including a list with complete descriptions of all functions that the proposed PTC system will perform to enhance or preserve safety;
(3) A description of target safety levels (e.g., MTTHE for major subsystems as defined in subpart H of this part), including requirements for system availability and a description of all backup methods of operation and any critical assumptions associated with the target levels;
(4) A complete description of how the proposed PTC system will enforce authorities and signal indications; and
(5) A complete description of how the proposed PTC system will appropriately and timely enforce all integrated hazard detectors in accordance with § 236.1005(c)(3), if applicable.
§ 236.1015   PTC Safety Plan content requirements and PTC System Certification.
(a) Before placing a PTC system required under this part in service, the host railroad must submit to FRA a PTCSP and receive a PTC System Certification. If the Associate Administrator finds that the PTCSP and supporting documentation support a finding that the system complies with this part, the Associate Administrator approves the PTCSP and issues a PTC System Certification. Receipt of a PTC System Certification affirms that the PTC system has been reviewed and approved by FRA in accordance with, and meets the requirements of, this part.
(b) A PTCSP submitted under this subpart may reference and utilize in accordance with this subpart any Type Approval previously issued by the Associate Administrator to any railroad, provided that the railroad:
(1) Maintains a continually updated PTCPVL pursuant to § 236.1023;
(2) Shows that the supplier from which they are procuring the PTC system has established and can maintain a quality control system for PTC system design and manufacturing acceptable to the Associate Administrator. The quality control system must include the process for the product supplier or vendor to promptly and thoroughly report any safety-relevant failure and previously unidentified hazards to each railroad using the product; and
(3) Provides the applicable licensing information.
(c) A PTCSP submitted in accordance with this subpart shall:
(1) Include the FRA approved PTCDP or, if applicable, the FRA issued Type Approval;
(2)(i) Specifically and rigorously document each variance, including the significance of each variance between the PTC system and its applicable operating conditions as described in the applicable PTCDP from that as described in the PTCSP, and attest that there are no other such variances; or
(ii) Attest that there are no variances between the PTC system and its applicable operating conditions as described in the applicable PTCDP from that as described in the PTCSP; and
(3) Attest that the system was otherwise built in accordance with the applicable PTCDP and PTCSP and achieves the level of safety represented therein.
(d) A PTCSP shall include the same information required for a PTCDP under § 236.1013(a). If a PTCDP has been filed and approved prior to filing of the PTCSP, the PTCSP may incorporate the PTCDP by reference, with the exception that a final human factors analysis shall be provided. The PTCSP shall contain the following additional elements:
(1) A hazard log consisting of a comprehensive description of all safety-relevant hazards not previously addressed by the vendor or supplier to be addressed during the life-cycle of the PTC system, including maximum threshold limits for each hazard (for unidentified hazards, the threshold shall be exceeded at one occurrence);
(2) A description of the safety assurance concepts that are to be used for system development, including an explanation of the design principles and assumptions;
(3) A risk assessment of the as-built PTC system described;
(4) A hazard mitigation analysis, including a complete and comprehensive description of each hazard and the mitigation techniques used;
(5) A complete description of the safety assessment and Verification and Validation processes applied to the PTC system, their results, and whether these processes address the safety principles described in Appendix C to this part directly, using other safety criteria, or not at all;
(6) A complete description of the railroad's training plan for railroad and contractor employees and supervisors necessary to ensure safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system;
(7) A complete description of the specific procedures and test equipment necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system on the railroad and establish safety-critical hazards are appropriately mitigated. These procedures, including calibration requirements, shall be consistent with or explain deviations from the equipment manufacturer's recommendations;
(8) A complete description of any additional warning to be placed in the Operations and Maintenance Manual in the same manner specified in § 236.919 and all warning labels to be placed on equipment as necessary to ensure safety;
(9) A complete description of the configuration or revision control measures designed to ensure that the railroad or its contractor does not adversely affect the safety-functional requirements and that safety-critical hazard mitigation processes are not compromised as a result of any such change;
(10) A complete description of all initial implementation testing procedures necessary to establish that safety-functional requirements are met and safety-critical hazards are appropriately mitigated;
(11) A complete description of all post-implementation testing (validation) and monitoring procedures, including the intervals necessary to establish that safety-functional requirements, safety-critical hazard mitigation processes, and safety-critical tolerances are not compromised over time, through use, or after maintenance (adjustment, repair, or replacement) is performed;
(12) A complete description of each record necessary to ensure the safety of the system that is associated with periodic maintenance, inspections, tests, adjustments, repairs, or replacements, and the system's resulting conditions, including records of component failures resulting in safety-relevant hazards ( see § 236.1037);
(13) A safety analysis to determine whether, when the system is in operation, any risk remains of an unintended incursion into a roadway work zone due to human error. If the analysis reveals any such risk, the PTCDP and PTCSP shall describe how that risk will be mitigated;
(14) A more detailed description of any alternative arrangements as already provided under § 236.1005(a)(1)(i).
(15) A complete description of how the PTC system will enforce authorities and signal indications, unless already completely provided for in the PTCDP;
(16) A description of how the PTCSP complies with § 236.1019(f), if applicable;
(17) A description of any deviation in operational requirements for en route failures as specified under § 236.1029(c), if applicable and unless already completely provided for in the PTCDP;
(18) A complete description of how the PTC system will appropriately and timely enforce all integrated hazard detectors in accordance with § 236.1005;
(19) An emergency and planned maintenance temporary rerouting plan indicating how operations on the subject PTC system will take advantage of the benefits provided under § 236.1005(g) through (k); and
(20) The documents and information required under §§ 236.1007 and 236.1033.
(21) A list of each location where a locomotive with a failed onboard PTC apparatus will be regularly be exchanged or repaired pursuant to § 236.1029(b)(6) and a list of each movement that could take place pursuant to § 236.1029(b)(6) if the movement potentially could exceed 500 miles.
(e) The following additional requirements apply to:
(1) Non-vital overlay. A PTC system proposed as an overlay on the existing method of operation and not built in accordance with the safety assurance principles set forth in appendix C of this part must, to the satisfaction of the Associate Administrator, be shown to:
(i) Reliably execute the functions set forth in § 236.1005;
(ii) Obtain at least 80 percent reduction of the risk associated with accidents preventable by the functions set forth in § 236.1005, when all effects of the change associated with the PTC system are taken into account. The supporting risk assessment shall evaluate all intended changes in railroad operations coincident with the introduction of the new system; and
(iii) Maintain a level of safety for each subsequent system modification that is equal to or greater than the level of safety for the previous PTC systems.
(2) Vital overlay. A PTC system proposed on a newly constructed track or as an overlay on the existing method of operation and built in accordance with the safety assurance principles set forth in appendix C of this part must, to the satisfaction of the Associate Administrator, be shown to:
(i) Reliably execute the functions set forth in § 236.1005; and
(ii) Have sufficient documentation to demonstrate that the PTC system, as built, fulfills the safety assurance principles set forth in appendix C of this part. The supporting risk assessment may be abbreviated as that term is used in subpart H of this part.
(3) Stand-alone. A PTC system proposed on a newly constructed track, an existing track for which no signal system exists, as a replacement for an existing signal or train control system, or otherwise to replace or materially modify the existing method of operation, shall:
(i) Reliably execute the functions required by § 236.1005 and be demonstrated to do so to FRA's satisfaction; and
(ii) Have a PTCSP establishing, with a high degree of confidence, that the system will not introduce new hazards that have not been mitigated. The supporting risk assessment shall evaluate all intended changes in railroad operations in relation to the introduction of the new system and shall examine in detail the direct and indirect effects of all changes in the method of operations.
(4) Mixed systems. If a PTC system combining overlay, stand-alone, vital, or non-vital characteristics is proposed, the railroad shall confer with the Associate Administrator regarding appropriate structuring of the safety case and analysis.
(f) When determining whether the PTCSP fulfills the requirements under paragraph (d) of this section, the Associate Administrator may consider all available evidence concerning the reliability and availability of the proposed system and any and all safety consequences of the proposed changes. In any case where the PTCSP lacks adequate data regarding safety impacts of the proposed changes, the Associate Administrator may request the necessary data from the applicant. If the requested data is not provided, the Associate Administrator may find that potential hazards could or will arise.
(g) If a PTCSP applies to a system designed to replace an existing certified PTC system, the PTCSP will be approved provided that the PTCSP establishes with a high degree of confidence that the new system will provide a level of safety not less than the level of safety provided by the system to be replaced.
(h) When reviewing the issue of the potential data errors (for example, errors arising from data supplied from other business systems needed to execute the braking algorithm, survey data needed for location determination, or mandatory directives issued through the computer-aided dispatching system), the PTCSP must include a careful identification of each of the risks and a discussion of each applicable mitigation. In an appropriate case, such as a case in which the residual risk after mitigation is substantial or the underlying method of operation will be significantly altered, the Associate Administrator may require submission of a quantitative risk assessment addressing these potential errors.
§ 236.1017   Independent third party Verification and Validation.
(a) The PTCSP must be supported by an independent third-party assessment when the Associate Administrator concludes that it is necessary based upon the criteria set forth in § 236.913, with the exception that consideration of the methodology used in the risk assessment (§ 236.913(g)(2)(vii)) shall apply only to the extent that a comparative risk assessment was required. To the extent practicable, FRA makes this determination not later than review of the PTCIP and the accompanying PTCDP or PTCSP. If an independent assessment is required, the assessment may apply to the entire system or a designated portion of the system.
(b) If a PTC system is to undergo an independent assessment in accordance with this section, the host railroad may submit to the Associate Administrator a written request that FRA confirm whether a particular entity would be considered an independent third party pursuant to this section. The request should include supporting information identified in paragraph (c) of this section. FRA may request further information to make a determination or provide its determination in writing.
(c) As used in this section, “independent third party” means a technically competent entity responsible to and compensated by the railroad (or an association on behalf of one or more railroads) that is independent of the PTC system supplier and vendor. An entity that is owned or controlled by the supplier or vendor, that is under common ownership or control with the supplier or vendor, or that is otherwise involved in the development of the PTC system is not considered “independent” within the meaning of this section.
(d) The independent third-party assessment shall, at a minimum, consist of the activities and result in the production of documentation meeting the requirements of Appendix F to this part, unless excepted by this part or by FRA order or waiver.
(e) Information provided that has been certified under the auspices of a foreign railroad regulatory entity recognized by the Associate Administrator may, at the Associate Administrator's discretion, be accepted as having been independently verified.
§ 236.1019   Main line track exceptions.
(a) Scope and procedure. This section pertains exclusively to exceptions from the rule that trackage over which scheduled intercity and commuter passenger service is provided is considered main line track requiring installation of a PTC system. One or more intercity or commuter passenger railroads, or freight railroads conducting joint passenger and freight operation over the same segment of track may file a main line track exclusion addendum (“MTEA”) to its PTCIP requesting to designate track as not main line subject to the conditions set forth in paragraphs (b) or (c) of this section. No track shall be designated as yard or terminal unless it is identified in an MTEA that is part of an FRA approved PTCIP.
(b) Passenger terminal exception. FRA will consider an exception in the case of trackage used exclusively as yard or terminal tracks by or in support of regularly scheduled intercity or commuter passenger service where the MTEA describes in detail the physical boundaries of the trackage in question, its use and characteristics (including track and signal charts) and all of the following apply:
(1) The maximum authorized speed for all movements is not greater than 20 miles per hour, and that maximum is enforced by any available onboard PTC equipment within the confines of the yard or terminal;
(2) Interlocking rules are in effect prohibiting reverse movements other than on signal indications without dispatcher permission; and
(3) Either of the following conditions exists:
(i) No freight operations are permitted; or
(ii) Freight operations are permitted but no passengers will be aboard passenger trains within the defined limits.
(c) Limited operations exception. FRA will consider an exception in the case of a track segment used for limited operations (operating in accordance with § 236.0 of this part) under one of the following sets of conditions:
(1) The trackage is used for limited operations by at least one passenger railroad subject to at least one of the following conditions:
(i) All trains are limited to restricted speed;
(ii) Temporal separation of passenger and other trains is maintained as provided in paragraph (e) of this section; or
(iii) Passenger service is operated under a risk mitigation plan submitted by all railroads involved in the joint operation and approved by FRA. The risk mitigation plan must be supported by a risk assessment establishing that the proposed mitigations will achieve a level of safety not less than the level of safety that would obtain if the operations were conducted under paragraph (c)(1) or (c)(2) of this section.
(2) Passenger service is operated on a segment of track of a freight railroad that is not a Class I railroad on which less than 15 million gross tons of freight traffic is transported annually and on which one of the following conditions applies:
(i) If the segment is unsignaled and no more than four regularly scheduled passenger trains are operated during a calendar day, or
(ii) If the segment is signaled (e.g., equipped with a traffic control system, automatic block signal system, or cab signal system) and no more than 12 regularly scheduled passenger trains are operated during a calendar day.
(3) Not more than four passenger trains per day are operated on a segment of track of a Class I freight railroad on which less than 15 million gross tons of freight traffic is transported annually.
(d) A limited operations exception under paragraph (c) is subject to FRA review and approval. FRA may require a collision hazard analysis to identify hazards and may require that specific mitigations be undertaken. Operations under any such exception shall be conducted subject to the terms and conditions of the approval. Any main line track exclusion is subject to periodic review.
(e) Temporal separation. As used in this section, temporal separation means that limited passenger and freight operations do not operate on any segment of shared track during the same period and also refers to the processes or physical arrangements, or both, in place to ensure that temporal separation is established and maintained at all times. The use of exclusive authorities under mandatory directives is not, by itself, sufficient to establish that temporal separation is achieved. Procedures to ensure temporal separation shall include verification checks between passenger and freight operations and effective physical means to positively ensure segregation of passenger and freight operations in accordance with this paragraph.
(f) PTCSP requirement. No PTCSP—filed after the approval of a PTCIP with an MTEA—shall be approved by FRA unless it attests that no changes, except for those included in an FRA approved RFA, have been made to the information in the PTCIP and MTEA required by paragraph (b) or (c) of this section.
(g) Designation modifications. If subsequent to approval of its PTCIP or PTCSP the railroad seeks to modify which track or tracks should be designated as main line or not main line, it shall request modification of its PTCIP or PTCSP, as applicable, in accordance with § 236.1021.
§ 236.1020   [Reserved]
§ 236.1021   Discontinuances, material modifications, and amendments.
(a) No changes, as defined by this section, to a PTCIP or PTCDP may be made unless:
(1) The railroad files a request for amendment (RFA) to the applicable PTCIP or PTCDP with the Associate Administrator; and
(2) The Associate Administrator approves the RFA.
(b) After approval of an RFA in accordance with paragraph (a) of this section, the railroad shall immediately adopt and comply with the amendment.
(c) In lieu of a separate filing under part 235 of this chapter, a railroad may request approval of a discontinuance or material modification of a signal or train control system by filing an RFA to its PTCIP or PTCDP with the Associate Administrator.
(d) FRA will not approve an RFA to a PTCIP or PTCDP unless the request includes:
(1) The information listed in § 235.10 of this chapter and the railroad provides FRA upon request any additional information necessary to evaluate the RFA (see § 235.12), including:
(2) The proposed modifications;
(3) The reasons for each modification;
(4) The changes to the PTCIP or PTCDP, as applicable;
(5) Each modification's effect on PTC system safety;
(6) An approximate timetable for filing of the PTCDP, PTCSP, or both, if the amendment pertains to a PTCIP; and
(e) If the RFA includes a request for approval of a discontinuance or material modification of a signal or train control system, FRA will publish a notice in the Federal Register of the application and will invite public comment in accordance with part 211 of this chapter.
(f) When considering the RFA, FRA will review the issue of the discontinuance or material modification and determine whether granting the request is in the public interest and consistent with railroad safety, taking into consideration all changes in the method of operation and system functionalities, both within normal PTC system availability and in the case of a system failed state (unavailable), contemplated in conjunction with installation of the PTC system. The railroad submitting the RFA must, at FRA's request, perform field testing in accordance with § 236.1035 or engage in Verification and Validation in accordance with § 236.1017.
(g) FRA may issue at its discretion a new Type Approval number for a PTC system modified under this section.
(h) Changes requiring filing of an RFA. Except as provided by paragraph (i), an RFA shall be filed to request the following:
(1) Discontinuance of a PTC system, or other similar appliance or device;
(2) Decrease of the PTC system's limits (e.g., exclusion or removal of a PTC system on a track segment);
(3) Modification of a safety critical element of a PTC system; or
(4) Modification of a PTC system that affects the safety critical functionality of any other PTC system with which it interoperates.
(i) Discontinuances not requiring the filing of an RFA. It is not necessary to file an RFA for the following discontinuances:
(1) Removal of a PTC system from track approved for abandonment by formal proceeding;
(2) Removal of PTC devices used to provide protection against unusual contingencies such as landslide, burned bridge, high water, high and wide load, or tunnel protection when the unusual contingency no longer exists;
(3) Removal of the PTC devices that are used on a movable bridge that has been permanently closed by the formal approval of another government agency and is mechanically secured in the closed position for rail traffic; or
(4) Removal of the PTC system from service for a period not to exceed 6 months that is necessitated by catastrophic occurrence such as derailment, flood, fire, or hurricane, or earthquake.
(j) Changes not requiring the filing of an RFA. When the resultant change to the PTC system will comply with an approved PTCSP of this part, it is not necessary to file for approval to decrease the limits of a system when it involves the:
(1) Decrease of the limits of a PTC system when interlocked switches, derails, or movable-point frogs are not involved;
(2) Removal of an electric or mechanical lock, or signal used in lieu thereof, from hand-operated switch in a PTC system where train speed over such switch does not exceed 20 miles per hour, and use of those devices has not been part of the considerations for approval of a PTCSP; or
(3) Removal of an electric or mechanical lock, or signal used in lieu thereof, from a hand-operated switch in a PTC system where trains are not permitted to clear the main track at such switch and use of those devices has not been a part of the considerations for approval of a PTCSP.
(k) Modifications not requiring the filing of an RFA. When the resultant arrangement will comply with an approved PTCSP of this part, it is not necessary to file an application for approval of the following modifications:
(1) A modification that is required to comply with an order of the Federal Railroad Administration or any section of part 236 of this title;
(2) Installation of devices used to provide protection against unusual contingencies such as landslide, burned bridges, high water, high and wide loads, or dragging equipment;
(3) Elimination of existing track other than a second main track;
(4) Extension or shortening of a passing siding; or
(5) The temporary or permanent arrangement of existing systems necessitated by highway-rail grade separation construction. Temporary arrangements shall be removed within six months following completion of construction.
(l) Any RFA to a PTCDP or PTCSP pursuant to this section may be submitted jointly with other host railroads utilizing the same type of PTC system. However, only host railroads with the same PTC System Certification classification under § 236.1015(e) may jointly file an RFA to their PTCSPs. Any joint RFA to multiple host railroads' PTCSPs must include the information required under paragraph (m) of this section. The joint RFA must also include the written confirmation and statement specified under paragraphs (m)(2)(iii) and (iv) of this section from each host railroad jointly filing the RFA.
(m) No changes, as specified under paragraph (h)(3) or (4) of this section, may be made to an FRA-certified PTC system or an FRA-approved PTCSP unless the host railroad first complies with the following process:
(1) The host railroad revises its PTCSP to account for each proposed change to its PTC system and summarizes such changes in a chronological table of revisions at the beginning of its PTCSP;
(2) The host railroad electronically submits the following information in an RFA to the Director of FRA's Office of Railroad Systems and Technology:
(i) A summary of the proposed changes to any safety-critical elements of a PTC system, including a summary of how the changes to the PTC system would affect its safety-critical functionality, how any new hazards have been addressed and mitigated, whether each change is a planned change that was previously included in all required analysis under § 236.1015 or an unplanned change, and the reason for the proposed changes, including whether the changes are necessary to address or resolve an emergency or urgent issue;
(ii) Any associated software release notes;
(iii) A confirmation that the host railroad has notified any applicable tenant railroads of the proposed changes, any associated effect on the tenant railroads' operations, and any actions the tenant railroads must take in accordance with the configuration control measures set forth in the host railroad's PTCSP;
(iv) A statement from a qualified representative of the host railroad, verifying that the modified PTC system would meet all technical requirements under this subpart, provide an equivalent or greater level of safety than the existing PTC system, and not adversely impact interoperability with any tenant railroads; and
(v) Any other information that FRA requests; and
(3) A host railroad shall not make any changes, as specified under paragraph (h)(3) or (4) of this section, to its PTC system until the Director of FRA's Office of Railroad Systems and Technology approves the RFA.
(i) FRA will approve, approve with conditions, or deny the RFA within 45 days of the date on which the RFA was filed under paragraph (m)(2) of this section.
(ii) FRA reserves the right to notify a railroad that changes may proceed prior to the 45-day mark, including in an emergency or under other circumstances necessitating a railroad's immediate implementation of the proposed changes to its PTC system.
(iii) FRA may require a railroad to modify its RFA or its PTC system to the extent necessary to ensure safety or compliance with the requirements of this part.
(iv) Following any FRA denial of an RFA, each applicable railroad is prohibited from making the proposed changes to its PTC system until the railroad both sufficiently addresses FRA's questions, comments, and concerns and obtains FRA's approval. Consistent with paragraph (l) of this section, any host railroads utilizing the same type of PTC system, including the same certification classification under § 236.1015(e), may jointly submit information to address FRA's questions, comments, and concerns following any denial of an RFA under this section.
§ 236.1023   Errors and malfunctions.
(a) Each railroad implementing a PTC system on its property shall establish and continually update a PTC Product Vendor List (PTCPVL) that includes all vendors and suppliers of each PTC system, subsystem, component, and associated product, and process in use system-wide. The PTCPVL shall be made available to FRA upon request.
(b)(1) The railroad shall specify within its PTCSP all contractual arrangements with hardware and software suppliers or vendors for immediate notification between the parties of any and all safety-critical software failures, upgrades, patches, or revisions, as well as any hardware repairs, replacements, or modifications for their PTC system, subsystems, or components.
(2) A vendor or supplier, on receipt of a report of any safety-critical failure to their product, shall promptly notify all other railroads that are using that product, whether or not the other railroads have experienced the reported failure of that safety-critical system, subsystem, or component.
(3) The notification from a supplier to any railroad shall include explanation from the supplier of the reasons for such notification, the circumstances associated with the failure, and any recommended mitigation actions to be taken pending determination of the root cause and final corrective actions.
(c) The railroad shall:
(1) Specify the railroad's process and procedures in its PTCSP for action upon their receipt of notification of safety-critical failure, as well as receipt of a safety-critical upgrade, patch, revision, repair, replacement, or modification.
(2) Identify configuration/revision control measures in its PTCSP that are designed to ensure the safety-functional requirements and the safety-critical hazard mitigation processes are not compromised as a result of any change and that such a change can be audited.
(d) The railroad shall provide to the applicable vendor or supplier the railroad's procedures for action upon notification of a safety-critical failure, upgrade, patch, or revision for the PTC system, subsystem, component, product, or process, and actions to be taken until the faulty system, subsystem, or component has been adjusted, repaired or replaced.
(e) After the product is placed in service, the railroad shall maintain a database of all safety-relevant hazards as set forth in the PTCSP and those that had not previously been identified in the PTCSP. If the frequency of the safety-relevant hazard exceeds the thresholds set forth in the PTCSP, or has not been previously identified in the appropriate risk analysis, the railroad shall:
(1) Notify the applicable vendor or supplier and FRA of the failure, malfunction, or defective condition that decreased or eliminated the safety functionality;
(2) Keep the applicable vendor or supplier and FRA apprised on a continual basis of the status of any and all subsequent failures; and
(3) Take prompt counter measures to reduce or eliminate the frequency of the safety-relevant hazards below the threshold identified in the PTCSP.
(f) Each notification to FRA required by this section shall:
(1) Be made within 15 days after the vendor, supplier, or railroad discovers the failure, malfunction, or defective condition. However, a report that is due on a Saturday or a Sunday may be delivered on the following Monday and one that is due on a holiday may be delivered on the next business day;
(2) Be transmitted in a manner and form acceptable to the Associate Administrator and by the most expeditious method available; and
(3) Include as much available and applicable information as possible, including:
(i) PTC system name and model;
(ii) Identification of the part, component, or system involved, including the part number as applicable;
(iii) Nature of the failure, malfunctions, or defective condition;
(iv) Mitigation taken to ensure the safety of train operation, railroad employees, and the public; and
(v) The estimated time to correct the failure.
(4) In the event that all information required by paragraph (f)(3) of this section is not immediately available, the non-available information shall be forwarded to the Associate Administrator as soon as practicable in supplemental reports.
(g) Whenever any investigation of an accident or service difficulty report shows that a PTC system or product is unsafe because of a manufacturing or design defect, the railroad and its vendor or supplier shall, upon request of the Associate Administrator, report to the Associate Administrator the results of its investigation and any action taken or proposed to correct that defect.
(h) PTC system and product suppliers and vendors shall:
(1) Promptly report any safety-relevant failures or defective conditions, previously unidentified hazards, and recommended mitigation actions in their PTC system, subsystem, or component to each railroad using the product; and
(2) Notify FRA of any safety-relevant failure, defective condition, or previously unidentified hazard discovered by the vendor or supplier and the identity of each affected and notified railroad.
(i) The requirements of this section do not apply to failures, malfunctions, or defective conditions that:
(1) Are caused by improper maintenance or improper usage; or
(2) Have been previously identified to the FRA, vendor or supplier, and applicable user railroads.
(j) When any safety-critical PTC system, subsystem, or component fails to perform its intended function, the cause shall be determined and the faulty product adjusted, repaired, or replaced without undue delay. Until corrective action is completed, a railroad shall take appropriate action to ensure safety and reliability as specified within its PTCSP.
(k) Any railroad experiencing a failure of a system resulting in a more favorable aspect than intended or other condition hazardous to the movement of a train shall comply with the reporting requirements, including the making of a telephonic report of an accident or incident involving such failure, under part 233 of this chapter. Filing of one or more reports under part 233 of this chapter does not exempt a railroad, vendor, or supplier from the reporting requirements contained in this section.
§ 236.1025   [Reserved]
§ 236.1027   PTC system exclusions.
(a) The requirements of this subpart apply to each office automation system that performs safety-critical functions within, or affects the safety performance of, the PTC system. For purposes of this section, “office automation system” means any centralized or distributed computer-based system that directly or indirectly controls the active movement of trains in a rail network.
(b) Changes or modifications to PTC systems otherwise excluded from the requirements of this subpart by this section do not exclude those PTC systems from the requirements of this subpart if the changes or modifications result in a degradation of safety or a material decrease in safety-critical functionality.
(c) Primary train control systems cannot be integrated with locomotive electronic systems unless the complete integrated systems:
(1) Have been shown to be designed on fail-safe principles;
(2) Have demonstrated to operate in a fail-safe mode;
(3) Have a manual fail-safe fallback and override to allow the locomotive to be brought to a safe stop in the event of any loss of electronic control; and
(4) Are included in the approved and applicable PTCDP and PTCSP.
(d) PTC systems excluded by this section from the requirements of this subpart remain subject to subparts A through H of this part as applicable.
§ 236.1029   PTC system use and failures.
(a) When any safety-critical PTC system component fails to perform its intended function, the cause must be determined and the faulty component adjusted, repaired, or replaced without undue delay. Until repair of such essential components is completed, a railroad shall take appropriate action as specified in its PTCSP.
(b) En route failures. Except as provided in paragraphs (c) and (g) of this section, where a controlling locomotive that is operating in, or is to be operated within, a PTC-equipped track segment experiences PTC system failure or the PTC system is otherwise cut out while en route (i.e., after the train has departed its initial terminal), the train may only continue in accordance with all of the following:
(1) Except as provided in paragraph (b)(5) of this section, where no block signal system is in use, the train may proceed at a speed not to exceed 40 miles per hour; however, if the involved train is transporting one or more cars containing PIH materials, excluding those cars containing only a residue of PIH materials, the train may only proceed at a speed not to exceed 30 miles per hour.
(2) Where a block signal system is in place:
(i) A passenger train may proceed at a speed not to exceed 59 miles per hour;
(ii) A freight train transporting one or more cars containing PIH materials, excluding those cars containing only a residue of PIH materials, may proceed at a speed not to exceed 40 miles per hour; and
(iii) Any other freight train may proceed at a speed not to exceed 49 miles per hour.
(3) Where a cab signal system with an automatic train control system is in use, the train may proceed at a speed not to exceed 79 miles per hour.
(4) A report of the failure or cut-out must be made to a designated railroad officer of the host railroad as soon as safe and practicable.
(5) Where the PTC system is the exclusive method of delivering mandatory directives, an absolute block must be established in advance of the train as soon as safe and practicable, and the train shall not exceed restricted speed until the absolute block in advance of the train is established.
(6) Where the failure or cut-out is a result of a defective onboard PTC apparatus, the train may continue no farther than the next forward designated location for the repair or exchange of onboard PTC apparatuses.
(c) Exception for alternative system failure procedure. A railroad may submit for approval a PTCSP, an RFA, or an Order of Particular Applicability with an alternative system failure procedure other than that required by paragraph (b) of this section. FRA may, in its discretion, approve such an alternative system failure procedure if it provides similar requirements of, and an equivalent or greater level of safety as, the requirements of paragraph (b) of this section.
(d) Each railroad shall comply with all provisions in the applicable PTCDP and PTCSP for each PTC system it uses and shall operate within the scope of initial operational assumptions and predefined changes identified.
(e) The normal functioning of any safety-critical PTC system must not be interfered with in testing or otherwise without first taking measures to provide for the safe movement of trains, locomotives, roadway workers, and on-track equipment that depend on the normal functioning of the system.
(f) [Reserved]
(g) Temporary exceptions. From October 21, 2014 through the 24 months following the date of required PTC system implementation established by section 20157 of title 49 of the United States Code—
(1) A railroad's PTCSP or Order of Particular Applicability may provide for compliance with the en route failure requirements of § 236.567 instead of paragraph (b) of this section where a controlling locomotive that is operating in, or is to be operated within, a PTC-equipped track segment experiences PTC system failure or the PTC system is otherwise cut out while en route;
(2) A train may proceed as prescribed under either paragraph (b) of this section or § 236.567 where the PTC system fails to initialize for any reason prior to the train's departure from its initial terminal; and
(3) A railroad's PTCSP may provide for the temporary disabling of PTC system service where necessary to perform PTC system repair or maintenance. In this paragraph (g)(3), “PTC system service” does not refer to the failure of the onboard PTC apparatus for a single locomotive, locomotive consist, or train.
(i) The PTCSP shall specify appropriate operating rules to apply when the PTC system is temporarily disabled in accordance with this paragraph (g)(3).
(ii) The railroad shall make reasonable efforts to schedule the temporary disabling of PTC system service for times posing the least risk to railroad safety.
(iii) The railroad shall provide notice to the FRA regional office having jurisdiction over that territory at least 7 days in advance of planned temporary disabling of PTC system service and contemporaneous notice for unplanned temporary disabling of PTC system service.
(iv) The PTC system that is temporarily disabled in accordance with this paragraph (g)(3) shall be placed back into service without undue delay.
(h) Biannual Report of PTC System Performance. (1) Each host railroad subject to 49 U.S.C. 20157 or this subpart shall electronically submit a Biannual Report of PTC System Performance on Form FRA F 6180.152, containing the following information for the applicable reporting period, separated by the host railroad, each applicable tenant railroad, and each PTC-governed track segment ( e.g., territory, subdivision, district, main line, branch, or corridor), consistent with the railroad's PTC Implementation Plan:
(i) The total number of PTC system initialization failures, and subtotals identifying the number of initialization failures where the source or cause was the onboard subsystem, wayside subsystem, communications subsystem, back office subsystem, or a non-PTC component;
(ii) The total number of PTC system cut outs, and subtotals identifying the number of cut outs where the source or cause was the onboard subsystem, wayside subsystem, communications subsystem, back office subsystem, or a non-PTC component;
(iii) The total number of PTC system malfunctions, and subtotals identifying the number of malfunctions where the source or cause was the onboard subsystem, wayside subsystem, communications subsystem, back office subsystem, or a non-PTC component;
(iv) The total number of enforcements by the PTC system;
(v) The number of enforcements by the PTC system in which an accident or incident was prevented;
(vi) The number of scheduled attempts at initialization of the PTC system; and
(vii) The number of train miles governed by the PTC system.
(2) A host railroad's Biannual Report of PTC System Performance (Form FRA F 6180.152) shall also include a summary of any actions the host railroad and its tenant railroads are taking to reduce the frequency and rate of initialization failures, cut outs, and malfunctions, such as any actions to correct or eliminate systemic issues and specific problems.
(3) Each host railroad shall electronically submit a Biannual Report of PTC System Performance (Form FRA F 6180.152) to FRA by the following due dates: July 31 (covering the period from January 1 to June 30), and January 31 (covering the period from July 1 to December 31 of the prior calendar year).
(4) Each tenant railroad that operates on a host railroad's PTC-governed main line(s), unless the tenant railroad is currently subject to an exception under § 236.1006(b)(4) or (5), shall submit the information required under paragraphs (h)(1) and (2) of this section to each applicable host railroad on a continuous basis.
(5) Any railroad operating a PTC system classified under FRA Type Approval Nos. FRA-TA-2010-001 or FRA-TA-2013-003 must begin submitting the metric required under paragraph (h)(1)(iv) of this section not later than January 31, 2023.
§ 236.1031   Previously approved PTC systems.
(a) Any PTC system fully implemented and operational prior to March 16, 2010, may receive PTC System Certification if the applicable PTC railroad, or one or more system suppliers and one or more PTC railroads, submits a Request for Expedited Certification (REC) letter to the Associate Administrator. The REC letter must do one of the following:
(1) Reference a product safety plan (PSP) approved by FRA under subpart H of this part and include a document fulfilling the requirements under §§ 236.1011 and 236.1013 not already included in the PSP;
(2) Attest that the PTC system has been approved by FRA and in operation for at least 5 years and has already received an assessment of Verification and Validation from an independent third party under part 236 or a waiver supporting such operation; or
(3) Attest that the PTC system is recognized under an Order issued prior to March 16, 2010.
(b) If an REC letter conforms to paragraph (a)(1) of this section, the Associate Administrator, at his or her sole discretion, may also issue a new Type Approval for the PTC system.
(c) In order to receive a Type Approval or PTC System Certification under paragraph (a) or (b) of this section, the PTC system must be shown to reliably execute the functionalities required by §§ 236.1005 and 236.1007 and otherwise conform to this subpart.
(d) Previous approval or recognition of a train control system, together with an established service history, may, at the request of the PTC railroad, and consistent with available safety data, be credited toward satisfaction of the safety case requirements set forth in this part for the PTCSP with respect to all functionalities and implementations contemplated by the approval or recognition.
(e) To the extent that the PTC system proposed for implementation under this subpart is different in significant detail from the system previously approved or recognized, the changes shall be fully analyzed in the PTCDP or PTCSP as would be the case absent prior approval or recognition.
(f) As used in this section—
(1) Approved refers to approval of a Product Safety Plan under subpart H of this part.
(2) Recognized refers to official action permitting a system to be implemented for control of train operations under an FRA order or waiver, after review of safety case documentation for the implementation.
(g) Upon receipt of an REC, FRA will consider all safety case information to the extent feasible and appropriate, given the specific facts before the agency. Nothing in this section limits re-use of any applicable safety case information by a party other than the party receiving:
(1) A prior approval or recognition referred to in this section; or
(2) A Type Approval or PTC System Certification under this subpart.
§ 236.1033   Communications and security requirements.
(a) All wireless communications between the office, wayside, and onboard components in a PTC system shall provide cryptographic message integrity and authentication.
(b) Cryptographic keys required under paragraph (a) of this section shall:
(1) Use an algorithm approved by the National Institute of Standards (NIST) or a similarly recognized and FRA approved standards body;
(2) Be distributed using manual or automated methods, or a combination of both; and
(3) Be revoked:
(i) If compromised by unauthorized disclosure of the cleartext key; or
(ii) When the key algorithm reaches its lifespan as defined by the standards body responsible for approval of the algorithm.
(c) The cleartext form of the cryptographic keys shall be protected from unauthorized disclosure, modification, or substitution, except during key entry when the cleartext keys and key components may be temporarily displayed to allow visual verification. When encrypted keys or key components are entered, the cryptographically protected cleartext key or key components shall not be displayed.
(d) Access to cleartext keys shall be protected by a tamper resistant mechanism.
(e) Each railroad electing to also provide cryptographic message confidentiality shall:
(1) Comply with the same requirements for message integrity and authentication under this section; and
(2) Only use keys meeting or exceeding the security strength required to protect the data as defined in the railroad's PTCSP and required under § 236.1013(a)(7).
(f) Each railroad, or its vendor or supplier, shall have a prioritized service restoration and mitigation plan for scheduled and unscheduled interruptions of service. This plan shall be included in the PTCDP or PTCSP as required by §§ 236.1013 or 236.1015, as applicable, and made available to FRA upon request, without undue delay, for restoration of communication services that support PTC system services.
(g) Each railroad may elect to impose more restrictive requirements than those in this section, consistent with interoperability requirements specified in the PTCSP for the system.
§ 236.1035   Field testing requirements.
(a) Before any field testing of an uncertified PTC system, or a product of an uncertified PTC system, or any regression testing of a certified PTC system is conducted on the general rail system, the railroad requesting the testing must provide:
(1) A complete description of the PTC system;
(2) An operational concepts document;
(3) A complete description of the specific test procedures, including the measures that will be taken to protect trains and on-track equipment;
(4) An analysis of the applicability of the requirements of subparts A through G of this part to the PTC system that will not apply during testing;
(5) The date the proposed testing shall begin;
(6) The test locations; and
(7) The effect on the current method of operation the PTC system will or may have under test.
(b) FRA may impose additional testing conditions that it believes may be necessary for the safety of train operations.
(c) Relief from regulations other than from subparts A through G of this part that the railroad believes are necessary to support the field testing, must be requested in accordance with part 211 of this title.
§ 236.1037   Records retention.
(a) Each railroad with a PTC system required to be installed under this subpart shall maintain at a designated office on the railroad:
(1) A current copy of each FRA approved Type Approval, if any, PTCDP, and PTCSP that it holds;
(2) Adequate documentation to demonstrate that the PTCSP and PTCDP meet the safety requirements of this subpart, including the risk assessment;
(3) An Operations and Maintenance Manual, pursuant to § 236.1039; and
(4) Training and testing records pursuant to § 236.1043(b).
(b) Results of inspections and tests specified in the PTCSP and PTCDP must be recorded pursuant to § 236.110.
(c) Each contractor providing services relating to the testing, maintenance, or operation of a PTC system required to be installed under this subpart shall maintain at a designated office training records required under § 236.1039(b).
(d) After the PTC system is placed in service, the railroad shall maintain a database of all safety-relevant hazards as set forth in the PTCSP and PTCDP and those that had not been previously identified in either document. If the frequency of the safety-relevant hazards exceeds the threshold set forth in either of these documents, then the railroad shall:
(1) Report the inconsistency in writing by mail, facsimile, e-mail, or hand delivery to the Director, Office of Safety Assurance and Compliance, FRA, 1200 New Jersey Ave, SE, Mail Stop 25, Washington, DC 20590, within 15 days of discovery. Documents that are hand delivered must not be enclosed in an envelope;
(2) Take prompt countermeasures to reduce the frequency of each safety-relevant hazard to below the threshold set forth in the PTCSP and PTCDP; and
(3) Provide a final report when the inconsistency is resolved to the FRA Director, Office of Safety Assurance and Compliance, on the results of the analysis and countermeasures taken to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the PTCSP and PTCDP.
§ 236.1039   Operations and Maintenance Manual.
(a) The railroad shall catalog and maintain all documents as specified in the PTCDP and PTCSP for the installation, maintenance, repair, modification, inspection, and testing of the PTC system and have them in one Operations and Maintenance Manual, readily available to persons required to perform such tasks and for inspection by FRA and FRA-certified state inspectors.
(b) Plans required for proper maintenance, repair, inspection, and testing of safety-critical PTC systems must be adequate in detail and must be made available for inspection by FRA and FRA-certified state inspectors where such PTC systems are deployed or maintained. They must identify all software versions, revisions, and revision dates. Plans must be legible and correct.
(c) Hardware, software, and firmware revisions must be documented in the Operations and Maintenance Manual according to the railroad's configuration management control plan and any additional configuration/revision control measures specified in the PTCDP and PTCSP.
(d) Safety-critical components, including spare equipment, must be positively identified, handled, replaced, and repaired in accordance with the procedures specified in the PTCDP and PTCSP.
(e) Each railroad shall designate in its Operations and Maintenance Manual an appropriate railroad officer responsible for issues relating to scheduled interruptions of service contemplated by § 236.1029.
§ 236.1041   Training and qualification program, general.
(a) Training program for PTC personnel. Employers shall establish and implement training and qualification programs for PTC systems subject to this subpart. These programs must meet the minimum requirements set forth in the PTCDP and PTCSP in §§ 236.1039 through 236.1045, as appropriate, for the following personnel:
(1) Persons whose duties include installing, maintaining, repairing, modifying, inspecting, and testing safety-critical elements of the railroad's PTC systems, including central office, wayside, or onboard subsystems;
(2) Persons who dispatch train operations (issue or communicate any mandatory directive that is executed or enforced, or is intended to be executed or enforced, by a train control system subject to this subpart);
(3) Persons who operate trains or serve as a train or engine crew member subject to instruction and testing under part 217 of this chapter, on a train operating in territory where a train control system subject to this subpart is in use;
(4) Roadway workers whose duties require them to know and understand how a train control system affects their safety and how to avoid interfering with its proper functioning; and
(5) The direct supervisors of persons listed in paragraphs (a)(1) through (a)(4) of this section.
(b) Competencies. The employer's program must provide training for persons who perform the functions described in paragraph (a) of this section to ensure that they have the necessary knowledge and skills to effectively complete their duties related to operation and maintenance of the PTC system.
§ 236.1043   Task analysis and basic requirements.
(a) Training structure and delivery. As part of the program required by § 236.1041, the employer shall, at a minimum:
(1) Identify the specific goals of the training program with regard to the target population (craft, experience level, scope of work, etc.), task(s), and desired success rate;
(2) Based on a formal task analysis, identify the installation, maintenance, repair, modification, inspection, testing, and operating tasks that must be performed on a railroad's PTC systems. This includes the development of failure scenarios and the actions expected under such scenarios;
(3) Develop written procedures for the performance of the tasks identified;
(4) Identify the additional knowledge, skills, and abilities above those required for basic job performance necessary to perform each task;
(5) Develop a training and evaluation curriculum that includes classroom, simulator, computer-based, hands-on, or other formally structured training designed to impart the knowledge, skills, and abilities identified as necessary to perform each task;
(6) Prior to assignment of related tasks, require all persons mentioned in § 236.1041(a) to successfully complete a training curriculum and pass an examination that covers the PTC system and appropriate rules and tasks for which they are responsible (however, such persons may perform such tasks under the direct onsite supervision of a qualified person prior to completing such training and passing the examination);
(7) Require periodic refresher training and evaluation at intervals specified in the PTCDP and PTCSP that includes classroom, simulator, computer-based, hands-on, or other formally structured training and testing, except with respect to basic skills for which proficiency is known to remain high as a result of frequent repetition of the task; and
(8) Conduct regular and periodic evaluations of the effectiveness of the training program specified in § 236.1041(a)(1) verifying the adequacy of the training material and its validity with respect to current railroads PTC systems and operations.
(b) Training records. Employers shall retain records which designate persons who are qualified under this section until new designations are recorded or for at least one year after such persons leave applicable service. These records shall be kept in a designated location and be available for inspection and replication by FRA and FRA-certified State inspectors
§ 236.1045   Training specific to office control personnel.
(a) Any person responsible for issuing or communicating mandatory directives in territory where PTC systems are or will be in use shall be trained in the following areas, as applicable:
(1) Instructions concerning the interface between the computer-aided dispatching system and the train control system, with respect to the safe movement of trains and other on-track equipment;
(2) Railroad operating rules applicable to the train control system, including provision for movement and protection of roadway workers, unequipped trains, trains with failed or cut-out train control onboard systems, and other on-track equipment; and
(3) Instructions concerning control of trains and other on-track equipment in case the train control system fails, including periodic practical exercises or simulations, and operational testing under part 217 of this chapter to ensure the continued capability of the personnel to provide for safe operations under the alternative method of operation.
(b) [Reserved]
§ 236.1047   Training specific to locomotive engineers and other operating personnel.
(a) Operating personnel. Training provided under this subpart for any locomotive engineer or other person who participates in the operation of a train in train control territory shall be defined in the PTCDP as well as the PTCSP. The following elements shall be addressed:
(1) Familiarization with train control equipment onboard the locomotive and the functioning of that equipment as part of the system and in relation to other onboard systems under that person's control;
(2) Any actions required of the onboard personnel to enable, or enter data to, the system, such as consist data, and the role of that function in the safe operation of the train;
(3) Sequencing of interventions by the system, including pre-enforcement notification, enforcement notification, penalty application initiation and post-penalty application procedures;
(4) Railroad operating rules and testing (part 217) applicable to the train control system, including provisions for movement and protection of any unequipped trains, or trains with failed or cut-out train control onboard systems and other on-track equipment;
(5) Means to detect deviations from proper functioning of onboard train control equipment and instructions regarding the actions to be taken with respect to control of the train and notification of designated railroad personnel; and
(6) Information needed to prevent unintentional interference with the proper functioning of onboard train control equipment.
(b) Locomotive engineer training. Training required under this subpart for a locomotive engineer, together with required records, shall be integrated into the program of training required by part 240 of this chapter.
(c) Full automatic operation. The following special requirements apply in the event a train control system is used to effect full automatic operation of the train:
(1) The PTCDP and PTCSP shall identify all safety hazards to be mitigated by the locomotive engineer.
(2) The PTCDP and PTCSP shall address and describe the training required with provisions for the maintenance of skills proficiency. As a minimum, the training program must:
(i) As described in § 236.1043(a)(2), develop failure scenarios which incorporate the safety hazards identified in the PTCDP and PTCSP including the return of train operations to a fully manual mode;
(ii) Provide training, consistent with § 236.1047(a), for safe train operations under all failure scenarios and identified safety hazards that affect train operations;
(iii) Provide training, consistent with § 236.1047(a), for safe train operations under manual control; and
(iv) Consistent with § 236.1047(a), ensure maintenance of manual train operating skills by requiring manual starting and stopping of the train for an appropriate number of trips and by one or more of the following methods:
(A) Manual operation of a train for a 4-hour work period;
(B) Simulated manual operation of a train for a minimum of 4 hours in a Type I simulator as required; or
(C) Other means as determined following consultation between the railroad and designated representatives of the affected employees and approved by FRA. The PTCDP and PTCSP shall designate the appropriate frequency when manual operation, starting, and stopping must be conducted, and the appropriate frequency of simulated manual operation.
(d) Conductor training. Training required under this subpart for a conductor, together with required records, shall be integrated into the program of training required under this chapter.
§ 236.1049   Training specific to roadway workers.
(a) Roadway worker training. Training required under this subpart for a roadway worker shall be integrated into the program of instruction required under part 214, subpart C of this chapter (“Roadway Worker Protection”), consistent with task analysis requirements of § 236.1043. This training shall provide instruction for roadway workers who provide protection for themselves or roadway work groups.
(b) Training subject areas. (1) Instruction for roadway workers shall ensure an understanding of the role of processor-based signal and train control equipment in establishing protection for roadway workers and their equipment.
(2) Instruction for all roadway workers working in territories where PTC is required under this subpart shall ensure recognition of processor-based signal and train control equipment on the wayside and an understanding of how to avoid interference with its proper functioning.
(3) Instructions concerning the recognition of system failures and the provision of alternative methods of on-track safety in case the train control system fails, including periodic practical exercises or simulations and operational testing under part 217 of this chapter to ensure the continued capability of roadway workers to be free from the danger of being struck by a moving train or other on-track equipment.